SweetPotato

SweetPotato bundles several SYSTEM-coercion primitives (EfsRpc, DCOM/RoguePotato-style OXID, PrintSpoofer, PetitPotam, WinRM) behind one binary, selected with -e, so you can fall back to whichever named-pipe or DCOM coercion the host permits. It captures the coerced SYSTEM token and launches the program in -p with the arguments in -a. Handy on IIS/MSSQL service accounts when you want to try multiple potato techniques without swapping tools. Requires SeImpersonatePrivilege. Command Reference: Privilege required: SeImpersonatePrivilege Exploit mode: EfsRpc

# -e selects the coercion primitive (EfsRpc | DCOM | WinRM | PrintSpoofer | PetitPotam)
SweetPotato.exe -p C:\Windows\System32\cmd.exe -a "/c whoami" -e EfsRpc

Native

PrivEsc, Exploitation

Requires

Shell

Services

DCOM, RPC

Refs

github.com/CCob/SweetPotato

book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer